Help

Because iOS does not tell us. Network activity is shown for the whole device; iOS doesn't identify the originating app.

A consumer packet tunnel on iPhone receives packets, not process identities. There is no API that maps a connection back to the app that opened it, and no clever workaround that produces a trustworthy answer. Anything on iOS claiming a confident per-app breakdown is inferring it from destination names — which is a guess, and wrong often enough to matter.

What you can do is read the destinations. In practice a handful of domains identify a service unambiguously, and Live Traffic groups by target so the pattern is usually legible even without app names.

No — and it cannot. Encrypted content stays encrypted.

FluxMoat does not install a root certificate, does not run a TLS intercepting proxy, and never asks you to trust a profile that would let it read inside your connections. It works from what is visible on the outside of a connection: destination address, hostname where DNS revealed one, port, protocol, and byte counts.

This is a deliberate limit, not a missing feature. An app that could read your encrypted traffic would be a far larger risk to you than the traffic it was inspecting.

No. FluxMoat observes and filters network activity locally. Your traffic never passes through servers operated by FluxMoat.

The VPN profile FluxMoat asks iOS to install is not a remote VPN. It is a local tunnel: iOS hands packets to an extension running on your own iPhone, that extension inspects and forwards them, and they go straight to their original destination. Nothing is relayed to us. There is no server of ours in the path because there is no server of ours at all.

The only things FluxMoat downloads are blocklists, and the complete list of where those come from is in the privacy policy.

Treat it as an estimate. Locations are estimates and may be inaccurate.

Country labels come from looking up the remote IP address in a database bundled inside the app. That is a reasonable guess about where an address is registered, which is not the same as where a server sits or where a company is. A CDN edge, a cloud region, a corporate VPN, or a stale registry entry will all move the answer.

It is genuinely useful for spotting that your phone talks to a country you did not expect. It is not evidence of where anybody is.

iOS allows one VPN of this kind at a time. Turning FluxMoat on turns the other one off, and turning the other one on turns FluxMoat off. This is enforced by iOS and no app can work around it.

The same fact has a consequence worth stating plainly: blocking in FluxMoat is a control, not a security boundary. Turning the tunnel off stops the filtering.

In one place only. The world map draws lines from roughly where you are to roughly where each connection went, and it needs a rough origin to do that. The first time you open Insights → Map, iOS asks for when-in-use location at reduced (city-level) accuracy.

That coordinate stays in memory while the map is open. It is never saved, logged, attached to a connection record, or transmitted. If you decline, the map drops the origin lines and carries on; nothing else changes and you are not asked again.

Reading your Wi-Fi network name for Wi-Fi automation is separate and does not use location access.

There isn't one, on purpose. FluxMoat decides by how far a rule reaches, not by a number you assign. The narrower the target, the more it wins:

1. A rule for an exact target — one hostname, one IP.
2. Beats a site-wide rule — *.example.com, or a network range.
3. Which beats a country policy.
4. And a port or protocol rule sits under all three.

When two rules reach equally far and disagree, Allow wins. That tie-break is between rules of the same reach — a broad Allow never overrides a narrow Block.

Your rules, country policies included, are checked before threat feeds and blocklists, so a rule of yours can overrule a list entry. Whatever none of them matched is left to the mode: Standard allows it, Strict blocks it, Ask applies the current profile's default and asks you afterwards.

Earlier versions had a 0–100 priority stepper. It was removed, and the removal is the feature — "Site-wide" tells you a rule for one host inside it will win, where "Priority 10" told you nothing unless you already knew what every other rule was sitting on.

Block only. A country policy covers targets seen from that country, and new ones as they show up. There is deliberately no allow direction — a country-wide allow would be a very broad statement built on an IP-address estimate, which is not a foundation worth putting an allow on.

A target's own rule still wins over the country policy.

Ping (ICMP) traffic isn't filtered yet, so ICMP rules have no effect. The rule editor says so at the moment you pick ICMP, rather than letting you build a rule and wonder later why it never fires.

Most likely it resolves its own names. Apps using their own encrypted DNS may bypass domain-based filtering; IP rules still apply.

If an app ships its own DNS-over-HTTPS client pointed at its own endpoint, its lookups never pass through anything FluxMoat can read, so there is no hostname to match a domain rule against. Settings has a "Block other encrypted DNS" switch that closes the common cases by blocking known public resolver endpoints, but an app aimed at a private endpoint of its own is a permanent blind spot and no list of public resolvers can close it. Blocking by IP address or range still works, because the packets still have to go somewhere.

Alerts don't pause a connection while waiting for your response. Ask mode is asynchronous and notification-driven: the connection is handled by the current profile's default, you are asked afterwards, and your answer shapes what happens next time.

This is not the desktop-style blocking dialog some firewalls use. iOS does not let a packet tunnel hold a connection open waiting on a human, so the app is labelled for what it actually does.

ThreatFox already works out of the box. FluxMoat ships with a subscription to its own mirror of the feed, rebuilt every 6 hours, no account and no key.

The indicators come from abuse.ch ThreatFox and are released under CC0 1.0. Our mirror republishes the domain and IP indicators a packet tunnel can actually act on, filtered to what is still current. It is an unofficial third-party mirror and is not operated, endorsed, or supported by abuse.ch — problems with the mirror belong with us, not with them.

On your phone, enabled lists refresh themselves when you open the app — checked every few hours at most, and left alone on Low Data Mode. A new subscription waits for your first Update.

Because the first download is always your decision. FluxMoat arrives with a few subscriptions listed, but nothing is fetched until you tap Update on one — a blocklist nobody asked for should never appear out of a silent fetch.

Once you have downloaded a list, keeping it fresh is maintenance of a choice you already made, so the app does that part for you.

You do not need one. It is optional and the app is fully functional without it.

A free abuse.ch Auth-Key lets you pull ThreatFox and URLhaus straight from abuse.ch as a "JSON manifest" blocklist, which updates sooner than our mirror. If you want that, you paste the key into Settings → Threat intelligence. The key is stored in the Keychain and only ever sent to abuse.ch. The app checks a subscription's host before it will attach the key, so it cannot leak to a third-party list URL. It is never included in a diagnostic report and never syncs to iCloud.

Honest answer: it costs what an always-on local tunnel costs, and we are not going to pretend that is nothing.

Every packet your device sends or receives passes through an extension running on the phone, which is real work that would not otherwise happen. Against that, FluxMoat does no continuous networking of its own — no telemetry, no polling, no uploads — and list refreshes are throttled to a few hours at most and skipped entirely on Low Data Mode. The heavy matching runs against in-memory structures built once when rules change, not per packet from disk.

We would rather publish a measured figure than an adjective, and we do not have one we would stand behind yet. iOS Settings → Battery will show you FluxMoat's actual share on your device and your usage, which is the number that matters anyway.

It fails open. If the extension stops or rules fail to load, connectivity is restored rather than blocked, and you are told about it. A privacy tool that silently takes your phone offline is a worse outcome than one that stops filtering, so that is the trade it makes.

There are two separate one-tap actions, kept separate on purpose so neither one surprises you:

• Settings → Data clears traffic history. You can also pick how long history is kept at all — 7 days, 30 days, 90 days, 6 months or 12 months, with 30 days the default. Choosing a shorter period deletes the excess immediately. Export produces a CSV containing the same fields shown in Live Traffic.
• Settings → Reset erases configuration: the rules, lists and preferences you have set up on this device. Traffic history is kept — that has its own button under Data.

Before either runs, the app shows an itemised list of exactly what will be cleared and what will be kept. Deleting the app removes all of it regardless.

Settings → Report a problem builds a short summary of your install — your settings and how many rules and lists you have. It shows you the whole thing before you share it, and it contains no browsing history, domains or network names. The report says so on its own first line: Settings and counts only. No logs, domains, IP addresses, network names or keys are included.

Nothing is sent automatically. The flow ends at the iOS share sheet, so where it goes is your choice. Send it to connect@hominexis.com, along with what you expected to happen and what happened instead.

You are equally welcome to just email us without a report attached.